One Step Forward, Two Steps Back? The Problem of the UK and Europol
Joining forces to fight crime might seem like a no-brainer. John Binns, financial crime partner at BCL Solicitors, considers that new working arrangements between the UK and Europol show the effort needed to maintain them post-Brexit
The way back
Few would consider it controversial to press for the closest possible working arrangements between European police forces in tackling transnational crime. And yet, in the process of the UK’s departure from the EU, and the negotiation of a new relationship, efforts to maintain those arrangements have been more challenging than many would have expected.
As things stand, a set of provisions in Part 3, Title V of the EU-UK Trade and Cooperation Agreement (TCA), now supplemented by Working and Administrative Arrangements (WAA), will see the UK and Europol working together (to an extent), for the time being, and subject to looming threats. Is this really the best we can do?
Opt-outs and opt-ins: the UK in the EU
The development of a body to help coordinate police cooperation within Europe has always had a compelling logic. On the one hand, it will always be in the interests of law enforcement bodies to cooperate and share information; on the other, the counterweight of protecting individual rights is provided by a shared set of standards, as exemplified by the European Convention on Human Rights (ECHR).
The UK’s approach to this logic has traditionally seemed somewhat Janus-like: having negotiated the right to opt out of all such measures, it proceeded to opt back into most of them, including Europol. While ensuring the ability of its citizens to enforce the ECHR in UK courts via the Human Rights Act 1998 (HRA), it has been slower to embrace the EU’s Charter of Fundamental Rights, as enforced by the Court of Justice of the European Union (CJEU).
The importance of data
Notably, even while the clouds of Brexit were gathering, the EU and the UK were putting in place a stronger set of personal data protections for their citizens, both generally and in the context of law enforcement. Alongside its better-known cousin, the General Data Protection Regulation (GDPR), the EU’s Law Enforcement Directive (LED) sets out the rules for processing data by the police and other agencies when investigating crime. In the UK, while the GDPR was introduced with direct effect while it was an EU member, its terms were supplemented by the domestic Data Protection Act 2018 (the DPA), Part 3 of which transposed the LED.
Brexit and Europol: the UK journey
Before the Brexit referendum, the UK’s then prime minister, David Cameron, said that if the vote was lost, he would stay on to negotiate a new relationship with the EU that would replicate, as far as possible, the existing one (which might have enabled, for instance, the UK to participate in Europol to the same extent as Norway or Iceland). Instead of that, his successor, Theresa May, set out various ‘red lines’ for the new relationship, which included ruling out any role for the CJEU. Nevertheless, Mrs May’s government appeared to contemplate very close working arrangements in law enforcement, and this was reflected in the (non-binding) Political Declaration (PD), eventually signed alongside the Withdrawal Agreement by her successor, Boris Johnson.
The PD stressed the importance of the UK’s continued commitment to the ECHR, and the EU’s assessment of the ‘adequacy’ of its data protection regimes, as the basis for continued cooperation. It referred to a dispute settlement mechanism that would refer questions of interpretation of EU law to the CJEU for a ‘binding ruling’ – appearing to suggest a way forward for future UK-Europol relations, while also arguably crossing Mrs May’s ‘red line’.
Casualty of a ‘hard Brexit’?
By the time of the TCA, the UK’s stance on its future relationship with the EU, including the role of the CJEU, had hardened significantly. With no apparent appetite to devise an alternative mechanism to ensure continued adherence to the standards of the ECHR or the LED, the basis of cooperation between the UK and Europol has inevitably become more fragile.
Broadly speaking, disputes will be settled by a Partnership Council (PC), and the ultimate mechanism for dealing with them is not to seek rulings from the CJEU or the PC, but to withdraw from or suspend, with notice, one or more sections of that Part, or, at worst, the entire TCA. This could occur if, for example, the UK withdrew from the ECHR, or if the EU’s adequacy decisions on its data protection regimes were reversed.
The ‘glass half full’ perspective
On one view, of course, such talk is unwarranted, or at least premature. For the time being, at least, what Title V and the WAA seem to offer is a working relationship that, as compared with those of other ‘third countries’, is strong, including the presence of National Crime Agency (NCA) liaison officers in Europol’s headquarters, access to its secure messaging system, the ability to attend organisational meetings and to contribute to analysis projects, and the fast and effective exchange of data.
It would be churlish, perhaps, to point out that the benefits obtained by the WAA are a fraction (albeit a fair one) of what it had before – which, with its specially negotiated ‘opt-in’ arrangements, was perhaps impossible to beat. These things are, we must presume, worth sacrificing for the prize of Brexit itself, and specifically for freeing the UK from the shackles of EU law (including the LED) and the CJEU.
Freedom…to do what?
Is it surely worth taking stock, in that case, of the freedoms the UK now has a third country to amend its own laws – in this context, specifically the HRA, the UK GDPR, and the DPA (particularly Part 3). On the one hand, it is no longer bound as an EU member to maintain these laws in their current form, and it would no longer have to answer to the CJEU if it amended them significantly. On the other hand, it must surely be mindful of the impact any changes to these laws might have on Part 3 of the TCA.
Regrettably, the indications for now are that the UK government is heading in the other direction. With respect to the UK GDPR, it has proposed in a consultation document a range of specific changes, which broadly speaking would water down both the substantive rights and the means of protecting them[1].
With respect to the LED, the consultation proposes various changes that would arguably prompt the EU to reconsider its adequacy decision, putting the Europol arrangements in Title V (among other things) in jeopardy. These include clearing more third countries to receive data from the UK, greater flexibility to process biometric data, such as facial images and fingerprints, introducing greater consistency in definitions between different parts of the DPA, and imposing duties on the Information Commissioner to take public safety into account when considering her rulings.
Have cake, eat it?
The jury is out on whether the UK will manage to make the changes it appears to want to its domestic law while maintaining the arrangements it has signed up to in the TCA and the WAA, or whether and when the EU will follow through by taking apart, piece by painful piece, the arrangements it has so carefully made with its newly liberated partner, including in Part 3 of the TCA.
If that includes Title V, and with it the WAA, then it will swiftly have real-world consequences, as UK law enforcement’s ability to cooperate with their EU counterparts will be damaged, to the benefit of no-one but the criminals and terrorists they are trying to investigate. UK citizens, whether they voted for it or not, might reasonably ask whether this is what Brexit meant.
John Binns is a partner at BCL Solicitors LLP in London, specialising in financial crime. He gave evidence to select committees of the House of Lords during the Brexit process about EU-UK cooperation in law enforcement.
John Binns
[1] https://www.gov.uk/government/consultations/data-a-new-direction
